CVE-2021-4088

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100, 11.7.x prior to 11.7.101, and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Jan 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-408819.8An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to execute arbitrary code.CVE-2021-408826.1A Cross Site Scripting (XSS) vulnerability exists in Piwigo 11.5.0 via the system album name and description of the location.CVE-2021-408839.8A Remote Code Execution (RCE) vulnerability exists in emlog 5.3.1 via content/plugins.CVE-2021-408848.1Projectsend version r1295 is affected by sensitive information disclosure. Because of not checking authorization in ids parameter in files-e CVE-2021-408866.5Projectsend version r1295 is affected by a directory traversal vulnerability. A user with Uploader role can add value `2` for `chunks` param CVE-2021-408879.8Projectsend version r1295 is affected by a directory traversal vulnerability. Because of lacking sanitization input for files[] parameter, a CVE-2021-408885.4Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() fu CVE-2021-408899.8CMSUno version 1.7.2 is affected by a PHP code execution vulnerability. sauvePass action in {webroot}/uno/central.php file calls to file_put CVE-2021-40894.3snipe-it is vulnerable to Improper Access Control CVE-2021-408927.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-color v2.1.0 when handling crafted invalid rgb(a) st CVE-2021-408937.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in validate-data v0.1.1 when validating crafted invalid emails.CVE-2021-408947.5A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in underscore-99xp v1.7.2 when the deepValueSearch function is c